/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.SetUtil;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import com.zimbra.cs.service.account.ToXML;
/*     */ import java.util.ArrayList;
/*     */ import java.util.Arrays;
/*     */ import java.util.Collections;
/*     */ import java.util.HashMap;
/*     */ import java.util.HashSet;
/*     */ import java.util.List;
/*     */ import java.util.Map;
/*     */ import java.util.Map.Entry;
/*     */ import java.util.Set;
/*     */ import java.util.SortedMap;
/*     */ import java.util.TreeMap;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class CollectEffectiveRights
/*     */ {
/*  44 */   private static final Log sLog = ZimbraLog.acl;
/*     */   
/*     */ 
/*     */   private RightBearer mRightBearer;
/*     */   
/*     */ 
/*     */   private Entry mTarget;
/*     */   
/*     */ 
/*     */   private TargetType mTargetType;
/*     */   
/*     */ 
/*     */   private boolean mExpandSetAttrs;
/*     */   
/*     */ 
/*     */   private boolean mExpandGetAttrs;
/*     */   
/*     */ 
/*     */   private RightCommand.EffectiveRights mResult;
/*     */   
/*     */ 
/*     */   static void getEffectiveRights(RightBearer rightBearer, Entry target, TargetType targetType, boolean expandSetAttrs, boolean expandGetAttrs, RightCommand.EffectiveRights result)
/*     */     throws ServiceException
/*     */   {
/*  68 */     CollectEffectiveRights cer = new CollectEffectiveRights(rightBearer, target, targetType, expandSetAttrs, expandGetAttrs, result);
/*     */     
/*  70 */     cer.collect();
/*     */   }
/*     */   
/*     */ 
/*     */   static void getEffectiveRights(RightBearer rightBearer, Entry target, boolean expandSetAttrs, boolean expandGetAttrs, RightCommand.EffectiveRights result)
/*     */     throws ServiceException
/*     */   {
/*  77 */     TargetType targetType = TargetType.getTargetType(target);
/*  78 */     getEffectiveRights(rightBearer, target, targetType, expandSetAttrs, expandGetAttrs, result);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private CollectEffectiveRights(RightBearer rightBearer, Entry target, TargetType targetType, boolean expandSetAttrs, boolean expandGetAttrs, RightCommand.EffectiveRights result)
/*     */   {
/*  87 */     this.mRightBearer = rightBearer;
/*  88 */     this.mTarget = target;
/*  89 */     this.mTargetType = targetType;
/*  90 */     this.mExpandSetAttrs = expandSetAttrs;
/*  91 */     this.mExpandGetAttrs = expandGetAttrs;
/*  92 */     this.mResult = result;
/*     */   }
/*     */   
/*     */   private boolean isGlobalAdmin()
/*     */   {
/*  97 */     return this.mRightBearer instanceof RightBearer.GlobalAdmin;
/*     */   }
/*     */   
/*     */   private RightBearer.Grantee getGrantee() {
/* 101 */     return (RightBearer.Grantee)this.mRightBearer;
/*     */   }
/*     */   
/*     */   private void collect() throws ServiceException
/*     */   {
/*     */     AllowedAttrs allowGetAttrs;
/*     */     Set<Right> presetRights;
/*     */     AllowedAttrs allowSetAttrs;
/*     */     AllowedAttrs allowGetAttrs;
/* 110 */     if (isGlobalAdmin())
/*     */     {
/* 112 */       Set<Right> presetRights = getAllExecutableAdminPresetRights();
/*     */       
/*     */ 
/* 115 */       AllowedAttrs allowSetAttrs = AllowedAttrs.ALLOW_ALL_ATTRS();
/*     */       
/*     */ 
/* 118 */       allowGetAttrs = AllowedAttrs.ALLOW_ALL_ATTRS();
/*     */     }
/*     */     else
/*     */     {
/* 122 */       presetRights = getEffectiveAdminPresetRights();
/*     */       
/*     */ 
/* 125 */       allowSetAttrs = CheckAttrRight.accessibleAttrs(getGrantee(), this.mTarget, AdminRight.PR_SET_ATTRS, false);
/*     */       
/*     */ 
/*     */ 
/* 129 */       allowGetAttrs = CheckAttrRight.accessibleAttrs(getGrantee(), this.mTarget, AdminRight.PR_GET_ATTRS, false);
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 136 */     Set<String> rights = new HashSet();
/* 137 */     for (Right r : presetRights) {
/* 138 */       rights.add(r.getName());
/*     */     }
/* 140 */     this.mResult.setPresetRights(setToSortedList(rights));
/*     */     
/*     */ 
/* 143 */     if (allowSetAttrs.getResult() == AllowedAttrs.Result.ALLOW_ALL) {
/* 144 */       this.mResult.setCanSetAllAttrs();
/* 145 */       if (this.mExpandSetAttrs) {
/* 146 */         this.mResult.setCanSetAttrs(expandAttrs(AdminRight.PR_SET_ATTRS));
/*     */       }
/* 148 */     } else if (allowSetAttrs.getResult() == AllowedAttrs.Result.ALLOW_SOME) {
/* 149 */       this.mResult.setCanSetAttrs(fillDefault(allowSetAttrs, AdminRight.PR_SET_ATTRS));
/*     */     }
/*     */     
/*     */ 
/* 153 */     if (allowGetAttrs.getResult() == AllowedAttrs.Result.ALLOW_ALL) {
/* 154 */       this.mResult.setCanGetAllAttrs();
/* 155 */       if (this.mExpandGetAttrs) {
/* 156 */         this.mResult.setCanGetAttrs(expandAttrs(AdminRight.PR_GET_ATTRS));
/*     */       }
/* 158 */     } else if (allowGetAttrs.getResult() == AllowedAttrs.Result.ALLOW_SOME) {
/* 159 */       this.mResult.setCanGetAttrs(fillDefault(allowGetAttrs, AdminRight.PR_GET_ATTRS));
/*     */     }
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   private Set<Right> getAllExecutableAdminPresetRights()
/*     */     throws ServiceException
/*     */   {
/* 168 */     Map<String, AdminRight> allRights = RightManager.getInstance().getAllAdminRights();
/*     */     
/* 170 */     Set<Right> rights = new HashSet();
/*     */     
/* 172 */     for (Map.Entry<String, AdminRight> right : allRights.entrySet()) {
/* 173 */       Right r = (Right)right.getValue();
/* 174 */       if (r.isPresetRight()) {
/* 175 */         if (r.executableOnTargetType(this.mTargetType)) {
/* 176 */           rights.add(r);
/*     */         }
/*     */       }
/* 179 */       else if (r.isComboRight()) {
/* 180 */         ComboRight comboRight = (ComboRight)r;
/* 181 */         for (Right rt : comboRight.getPresetRights()) {
/* 182 */           if (rt.executableOnTargetType(this.mTargetType)) {
/* 183 */             rights.add(rt);
/*     */           }
/*     */         }
/*     */       }
/*     */     }
/*     */     
/* 189 */     return rights;
/*     */   }
/*     */   
/*     */   private Set<Right> getEffectiveAdminPresetRights() throws ServiceException
/*     */   {
/* 194 */     Provisioning prov = Provisioning.getInstance();
/*     */     
/* 196 */     RightBearer.Grantee grantee = getGrantee();
/* 197 */     TargetType targetType = TargetType.getTargetType(this.mTarget);
/*     */     
/* 199 */     Map<Right, Integer> allowed = new HashMap();
/* 200 */     Map<Right, Integer> denied = new HashMap();
/* 201 */     Integer relativity = Integer.valueOf(1);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 206 */     CheckAttrRight.CollectAttrsResult car = CheckAttrRight.CollectAttrsResult.SOME;
/*     */     
/*     */ 
/* 209 */     List<ZimbraACE> acl = ACLUtil.getAllACEs(this.mTarget);
/* 210 */     if (acl != null) {
/* 211 */       collectAdminPresetRightOnTarget(acl, targetType, relativity, false, allowed, denied);
/* 212 */       relativity = Integer.valueOf(relativity.intValue() + 2);
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/* 219 */     Domain targetDomain = TargetType.getTargetDomain(prov, this.mTarget);
/*     */     
/*     */ 
/* 222 */     boolean expandTargetGroups = CheckRight.allowGroupTarget(AdminRight.PR_ADMIN_PRESET_RIGHT);
/* 223 */     TargetIterator iter = TargetIterator.getTargetIeterator(prov, this.mTarget, expandTargetGroups);
/*     */     
/*     */ 
/* 226 */     GroupACLs groupACLs = null;
/*     */     Entry grantedOn;
/* 228 */     while (((grantedOn = iter.next()) != null) && (!car.isAll())) {
/* 229 */       acl = ACLUtil.getAllACEs(grantedOn);
/*     */       
/* 231 */       if ((grantedOn instanceof Group)) {
/* 232 */         if (acl != null)
/*     */         {
/*     */ 
/* 235 */           boolean skipPositiveGrants = false;
/*     */           
/*     */ 
/*     */ 
/* 239 */           if (grantee.isAccount()) {
/* 240 */             skipPositiveGrants = !CrossDomain.crossDomainOK(prov, grantee.getAccount(), grantee.getDomain(), targetDomain, (Group)grantedOn);
/*     */           }
/*     */           
/*     */ 
/*     */ 
/*     */ 
/* 246 */           if (groupACLs == null) {
/* 247 */             groupACLs = new GroupACLs(this.mTarget);
/*     */           }
/* 249 */           groupACLs.collectACL((Group)grantedOn, skipPositiveGrants);
/*     */         }
/*     */         
/*     */       }
/*     */       else
/*     */       {
/* 255 */         if (groupACLs != null) {
/* 256 */           List<ZimbraACE> aclsOnGroupTargets = groupACLs.getAllACLs();
/* 257 */           if (aclsOnGroupTargets != null) {
/* 258 */             collectAdminPresetRightOnTarget(aclsOnGroupTargets, targetType, relativity, false, allowed, denied);
/*     */             
/* 260 */             relativity = Integer.valueOf(relativity.intValue() + 2);
/*     */           }
/*     */           
/*     */ 
/* 264 */           groupACLs = null;
/*     */         }
/*     */         
/* 267 */         if (acl != null)
/*     */         {
/*     */ 
/*     */ 
/* 271 */           boolean subDomain = (this.mTargetType == TargetType.domain) && ((grantedOn instanceof Domain));
/* 272 */           collectAdminPresetRightOnTarget(acl, targetType, relativity, subDomain, allowed, denied);
/* 273 */           relativity = Integer.valueOf(relativity.intValue() + 2);
/*     */         }
/*     */       }
/*     */     }
/* 277 */     if (sLog.isDebugEnabled()) {
/* 278 */       StringBuilder sbAllowed = new StringBuilder();
/* 279 */       for (Map.Entry<Right, Integer> a : allowed.entrySet()) {
/* 280 */         sbAllowed.append("(" + ((Right)a.getKey()).getName() + ", " + a.getValue() + ") ");
/*     */       }
/* 282 */       sLog.debug("allowed: " + sbAllowed.toString());
/*     */       
/* 284 */       StringBuilder sbDenied = new StringBuilder();
/* 285 */       for (Map.Entry<Right, Integer> a : denied.entrySet()) {
/* 286 */         sbDenied.append("(" + ((Right)a.getKey()).getName() + ", " + a.getValue() + ") ");
/*     */       }
/* 288 */       sLog.debug("denied: " + sbDenied.toString());
/*     */     }
/*     */     
/* 291 */     Set<Right> conflicts = SetUtil.intersect(allowed.keySet(), denied.keySet());
/* 292 */     if (!conflicts.isEmpty()) {
/* 293 */       for (Right right : conflicts) {
/* 294 */         if (((Integer)denied.get(right)).intValue() <= ((Integer)allowed.get(right)).intValue()) {
/* 295 */           allowed.remove(right);
/*     */         }
/*     */       }
/*     */     }
/* 299 */     return allowed.keySet();
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   private void collectAdminPresetRightOnTarget(List<ZimbraACE> acl, TargetType targeType, Integer relativity, boolean subDomain, Map<Right, Integer> allowed, Map<Right, Integer> denied)
/*     */     throws ServiceException
/*     */   {
/* 307 */     short granteeFlags = 3;
/* 308 */     collectAdminPresetRights(acl, targeType, granteeFlags, relativity, subDomain, allowed, denied);
/*     */     
/*     */ 
/*     */ 
/* 312 */     granteeFlags = 5;
/* 313 */     collectAdminPresetRights(acl, targeType, granteeFlags, relativity, subDomain, allowed, denied);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   private void collectAdminPresetRights(List<ZimbraACE> acl, TargetType targetType, short granteeFlags, Integer relativity, boolean subDomain, Map<Right, Integer> allowed, Map<Right, Integer> denied)
/*     */     throws ServiceException
/*     */   {
/* 322 */     for (ZimbraACE ace : acl) {
/* 323 */       GranteeType granteeType = ace.getGranteeType();
/* 324 */       if ((granteeType.hasFlags(granteeFlags)) && 
/*     */       
/*     */ 
/* 327 */         (RightBearer.matchesGrantee(getGrantee(), ace)) && (
/*     */         
/*     */ 
/*     */ 
/* 331 */         (ace.deny()) || 
/* 332 */         (subDomain == ace.subDomain())))
/*     */       {
/*     */ 
/*     */ 
/* 336 */         Right right = ace.getRight();
/*     */         
/* 338 */         if (!right.isUserRight())
/*     */         {
/*     */ 
/* 341 */           if (right.isComboRight()) {
/* 342 */             ComboRight comboRight = (ComboRight)right;
/* 343 */             for (Right r : comboRight.getPresetRights()) {
/* 344 */               if (r.executableOnTargetType(targetType)) {
/* 345 */                 collectPresetRightIfMoreRelevant(r, ace.deny(), relativity, allowed, denied);
/*     */               }
/*     */             }
/* 348 */           } else if ((right.isPresetRight()) && 
/* 349 */             (right.executableOnTargetType(targetType))) {
/* 350 */             collectPresetRightIfMoreRelevant(right, ace.deny(), relativity, allowed, denied);
/*     */           }
/*     */         }
/*     */       }
/*     */     }
/*     */   }
/*     */   
/*     */   private void collectPresetRightIfMoreRelevant(Right right, boolean negative, Integer relativity, Map<Right, Integer> allowed, Map<Right, Integer> denied)
/*     */   {
/* 359 */     Map<Right, Integer> map = negative ? denied : allowed;
/*     */     
/* 361 */     Integer mostRelevant = (Integer)map.get(right);
/* 362 */     if ((mostRelevant == null) || (relativity.intValue() < mostRelevant.intValue())) {
/* 363 */       map.put(right, relativity);
/*     */     }
/*     */   }
/*     */   
/*     */   private List<String> setToSortedList(Set<String> set) {
/* 368 */     List<String> list = new ArrayList(set);
/* 369 */     Collections.sort(list);
/* 370 */     return list;
/*     */   }
/*     */   
/*     */   private SortedMap<String, RightCommand.EffectiveAttr> fillDefault(AllowedAttrs allowSetAttrs, AttrRight rightNeeded) throws ServiceException
/*     */   {
/* 375 */     return fillDefaultAndConstratint(allowSetAttrs.getAllowed(), rightNeeded);
/*     */   }
/*     */   
/*     */   private SortedMap<String, RightCommand.EffectiveAttr> expandAttrs(AttrRight rightNeeded) throws ServiceException
/*     */   {
/* 380 */     return fillDefaultAndConstratint(TargetType.getAttrsInClass(this.mTarget), rightNeeded);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private SortedMap<String, RightCommand.EffectiveAttr> fillDefaultAndConstratint(Set<String> attrs, AttrRight rightNeeded)
/*     */     throws ServiceException
/*     */   {
/* 392 */     SortedMap<String, RightCommand.EffectiveAttr> effAttrs = new TreeMap();
/*     */     
/*     */ 
/* 395 */     Entry constraintEntry = AttributeConstraint.getConstraintEntry(this.mTarget);
/* 396 */     Map<String, AttributeConstraint> constraints = constraintEntry == null ? null : AttributeConstraint.getConstraint(constraintEntry);
/*     */     
/*     */ 
/* 399 */     boolean hasConstraints = (constraints != null) && (!constraints.isEmpty());
/*     */     
/* 401 */     for (String attrName : attrs)
/* 402 */       if ((rightNeeded != AdminRight.PR_SET_ATTRS) || (isGlobalAdmin()) || (!HardRules.isForbiddenAttr(attrName)))
/*     */       {
/*     */ 
/*     */ 
/*     */ 
/* 407 */         Set<String> defaultValues = null;
/*     */         
/* 409 */         Object defaultValue = this.mTarget.getAttrDefault(attrName);
/* 410 */         if ((defaultValue instanceof String)) {
/* 411 */           defaultValue = ToXML.fixupZimbraPrefTimeZoneId(attrName, (String)defaultValue);
/* 412 */           defaultValues = new HashSet();
/* 413 */           defaultValues.add((String)defaultValue);
/* 414 */         } else if ((defaultValue instanceof String[])) {
/* 415 */           defaultValues = new HashSet(Arrays.asList((String[])defaultValue));
/*     */         }
/*     */         
/* 418 */         AttributeConstraint constraint = hasConstraints ? (AttributeConstraint)constraints.get(attrName) : null;
/* 419 */         effAttrs.put(attrName, new RightCommand.EffectiveAttr(attrName, defaultValues, constraint));
/*     */       }
/* 421 */     return effAttrs;
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/CollectEffectiveRights.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */